Can't integrate PostgreSQ Flexible Server with Azure AD

Question

I'm flowing this documentation article: https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/how-to-configure-sign-in-azure-ad-authentication to use Azure AD for authentication with Azure Database for PostgreSQL - Flexible Server.

I did these steps:

1. Connect to the user's tenant with Connect-AzureAD
2. Register App in Azure AD (as a Web platform)
3. find Service Principal ObjectId and AppID by running Get-AzureADServicePrincipal in Azure CLI

and than, when I try to run

New-AzureADServicePrincipal -AppId ...................

where -AppId argument is registered in step 2 service account, I got following error:

the service principal name ................. is already in use

I tried create service principal with az ad sp create-for-rbac -n "...." too, but with the same effect.

What am I doing wrong?

Answer 1

Hi Adrian Lapierre ,

Thanks for sharing your solution. The error you encountered might be related to this Github issue: https://github.com/MicrosoftDocs/azure-docs/issues/103253

It looks like the "service principal already in use" error can get thrown when the Azure tenant within which this command executes already has such a service principal. The suggestion in the Github issue is to run the following:

Get-AzureADServicePrincipal -ObjectId 0049e2e2-fcea-4bc4-af90-bdb29a9bbe98

Then the suggestion is to run the New-AzureADServicePrincipal command only if the service principal does not exist. It looks like there is a fix for this problem that should be deployed within the month, though.

I'm glad also that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others", I'll repost your solution in case you'd like to "Accept" the answer.

Issue:

You were following the tutorial to use Azure AD for authentication with Azure Database for PostgreSQL - Flexible Server.

When running New-AzureADServicePrincipal -AppId you received the error:

The service principal name xxxx is already in use

Solution:

You were able to resolve this by running:

New-AzureADServicePrincipal -AppId XXXXXXXXXXXXXXXXXX

where XXXXXXXXXXXXXXXXXX is the AppId from error message from enabling AD authentication:

"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.","details":[{"code":"AadAuthEnableFailedDueToMissingGraphApiAccessPrincipal","message":"Expected Microsoft Graph API client application with ClientId = XXXXXXXXXXXXXXXXXX is not found in the TenantId = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx, or does not have required permissions."}]}

If you have any other questions or are running into more issues with the tutorial, please let me know.

Thank you again for your time and patience throughout this issue.

-

If the information accurately described your issue, please Accept the answer. This will help us as well as others in the community who might be researching the same issue.

Answer 2

I solve problem by running this:

New-AzureADServicePrincipal -AppId XXXXXXXXXXXXXXXXXX

where XXXXXXXXXXXXXXXXXX is the AppId from error message from enabling AD authentication

"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.","details":[{"code":"AadAuthEnableFailedDueToMissingGraphApiAccessPrincipal","message":"Expected Microsoft Graph API client application with ClientId = XXXXXXXXXXXXXXXXXX is not found in the TenantId = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx, or does not have required permissions."}]}